Hi
I wrote a simple form search dashboard using <table> module .
I found if the number of results over 50,000 , when I click any label of table fields (for example : please refer to below source code , if I click the label said s_Seq , table module will sort whole result base on the content of s_Seq field) , the table won't sort results correctly , if the number of results is less then 50,000 , sort function works fine .
anyone know why ? thanks.
<?xml version="1.0" encoding="UTF-8"?>
<form>
<fieldset>
<input type="time" />
</fieldset>
<row>
<table>
<searchTemplate> sourcetype=abc Type=2 | where len(ProdId)<10| dedup SeqNo | sort 0 SeqNo | delta SeqNo as diff | where diff>1 | eval s_Seq=SeqNo-diff+1 | eval e_Seq=if(diff>2,SeqNo-1,"") | eval s_time=strftime(_time,"%Y/%m/%d %H:%M:%S.%3N") | eval lost=diff-1 </searchTemplate>
<option name="count">10</option>
<option name="showPager">true</option>
<fields>s_time, s_Seq, e_Seq, lost</fields>
</table>
</row>
</form>
... View more